I assume you use plain React with
REACT_APP_ environment variables in
create-react-app need to be added during build time, are included in the static bundle and are public.
As also mentioned in their docs:
WARNING: Do not store any secrets (such as private API keys) in your React app!
Environment variables are embedded into the build, meaning anyone can view them by inspecting your app's files.
Link to the
create-react-app docs article:
You should consider using secrets on your server, not your client. In case you would use a full-stack framework like Next.js utilizing React, you can write server and client code in one application (in which only your backend touches your secrets).